Proof Portal
Omarchy
ProbeLabs65 findings · 95 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
vipsthumbnail still-image lane has no timeout; a stalled conversion wedges its lane and, when lazy, the shared pool
Medium-severity issue, currently open.
Description
The issue as recorded.
generate_thumbnail sends still images to env VIPS_CONCURRENCY=1 vipsthumbnail without a timeout (bin/omarchy-menu-images:199). The video lane wraps ffmpegthumbnailer in timeout -k 5 10. A still that stalls vips holds its lane forever. A corrupt or pathological file, or a path on a stalled mount, can cause the stall. An eager open, without --lazy-thumbnails or with --cache-only, waits for its whole fan-out before the picker opens. So one stalled still blocks that open. Lazy opens queue their stills for one shared background pool per rows cache (upstream #14117). The pool runs at most two converters and finishes each batch before it takes the next. So a stalled still holds the pool, and stills that later opens queue get no thumbnail while the stall lasts. Each later open queues the stalled still again, so a freed lane can stall again. At 393a43d4 each lazy open started its own generators, and later stills still converted. The generator holds the content-hash lock while its converter runs. The converter does not inherit the lock, so a killed generator frees it even when the converter hangs. A duplicate job for the stalled file waits 30 seconds on that lock and then gives up. The damage is lost lanes and missing thumbnails, not a lock deadlock.
Affected requirements
The requirement(s) this issue violates — click through to the spec.
Severity, explained
Why this is rated the way it is — and the scoring signals behind the rating (each ⓘ explains the term).
- why this rating
- Risk-rated
- risk area
- Availability
- CVE surface
- None
Where it is
The code the issue lives in — peek the affected function inline to see it in context.
- bin/omarchy-menu-images still-image thumbnail lane
How it's proven
The reproducer — an actual test that drives the real code and shows the issue happening. Run it yourself, or peek the test and the source it covers.
./pocs/menu-images-vips-still-no-timeout.sh
Reproduction steps
Technical steps for your engineers to confirm the issue by hand.
./pocs/menu-images-vips-still-no-timeout.sh
What protects you, and the fix
What limits your exposure today, and the planned remediation.
What protects you now
timeout -k 5 10 bounds the video lane. The converter does not inherit the content-hash lock, so a killed generator frees the lock. Lazy conversions run in at most two lanes at lowered CPU and I/O priority, so a stalled converter competes less with the desktop. Manual recovery is to kill the stalled vipsthumbnail process and to move a still that stalls again out of the directory.
The fix
Wrap the vipsthumbnail invocation in timeout (matching the video lane) or add an async kill to the generator. Then close this KI and flip the THMB deferral
Blast radius
If you touch this issue, what else may need re-checking — the requirements it affects and the code and tests that hang off them. Historical view: authored trace links only — automatically derived links aren't reconstructible for past runs.
Touch this finding and you re-check 1 requirements · 1 code files · 1 tests.
- omarchy-menu-images
- menu-images-test.sh
Per-requirement evidence
For each requirement this finding touches: the implementing code, verifying tests, and proof obligations that discharge it.
Per-requirement evidence
For each requirement this finding touches: the implementing code, verifying tests, and proof obligations that discharge it.
Evidence trail
The raw evidence manifests behind this finding — superseded by the resolved reproducer above, kept here for traceability.
Evidence trail
The raw evidence manifests behind this finding — superseded by the resolved reproducer above, kept here for traceability.
- proof/evidence/ki-menu-images-vips-no-timeout.yaml
Change history
Every recorded revision of this finding's source file — when it was added, edited, or re-classified, with the diff for each change.
Discussions
Discuss this with the proof team. Nothing changes in your audit automatically — you open a request and a staff member records any outcome inside the thread.